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Abstract 

In this paper, we investigate the index coding problem in the presence of an eavesdropper. Messages are to be 
sent from one transmitter to a number of legitimate receivers who have side information about the messages, and 
share a set of secret keys with the transmitter. We assume perfect secrecy, meaning that the eavesdropper should not 
be able to retrieve any information about the message set. We study the minimum key lengths for zero-error and 
perfectly secure index coding problem. On one hand, this problem is a generalization of the index coding problem 
(and thus a difficult one). On the other hand, it is a generalization of the Shannon’s cipher system. We show that a 
generalization of Shannon’s one-time pad strategy is optimal up to a multiplicative constant, meaning that it obtains 
the entire boundary of the cone formed by looking at the secure rate region from the origin. Finally, we consider 
relaxation of the perfect secrecy and zero-error constraints to weak secrecy and asymptotically vanishing probability 
of error, and provide a secure version of the result, obtained by Langberg and Effros, on the equivalence of zero-error 
and e-error regions in the conventional index coding problem. 

Index Terms 

Index coding. Shannon cipher system, perfect secrecy, common and private keys, zero-error communication. 

I. Introduction 

An index coding problem comprises of a server, u clients and a set of distinct messages M = {Mi, M2, ■ ■ ■ , Mt}. 
Each client has a subset of M as its side information, and wants to learn another subset of the message set which it 
has not. The goal is to find the minimum number of information bits that should be broadcast by the server so that 
each client can recover its desired messages with zero-error probability. This minimum required bits of information 
is called the optimal index code length. The index coding problem was originally introduced by Birk and Kol |[T| 
in a satellite communication scenario. Consider a satellite that broadcasts a set of messages to a number of clients. 
Each receiver may miss some of the messages due to limited storage capacity, lack of interest, interrupted reception, 
or any other reason. The clients then inform the server about the messages they desire but are missing, as well 
as their side information via a feedback channel, and the server attempts to deliver their requested information 
by broadcasting information to all the clients. Index coding studies the efficient way of satisfying the needs of 
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clients with minimum transmission from the satellite. To illustrate the signihcance of index coding, consider a 
communication scenario with one server, two clients and a message set {Mi, M 2 } of binary random variables. The 
first client has M 2 as side information and wants Mi, yet the second one has Mi and wants M 2 . The server can 
send the XOR of Mi and M 2 , instead of broadcasting each of them individually. 

An index coding problem, in its most general case, can be represented by a directed bipartite graph Q or a 
hypergraph 0. However, it admits a simple graphical representation on a directed graph if each message is desired 
by only one client. In this case, without loss of generality one can assume that the number of receivers and messages 
are the same (a client that desires two different messages can be replaced with two identical clients that desire a 
message each). Many of the known results in the literature are for this special case, which we also adopt in this 
paper. 

Several upper and lower bounds are known for the optimal index code length £*{G) ifTI- llTol . Most of proposed 
bounds are graph-theoretic based, but Q considers this problem from an information-theoretic viewpoint and 
computes the capacity region of index coding problem with up to five messages. When we restrict ourselves to 
linear operations, the optimal linear index code is equal to a graph parameter called min-rank a, im. However, 
the computation of min-rank is NP-hard IfT^ . Furthermore, linear index coding can be suboptimal in general Q. 
Index coding is a special case of the network coding problem. On the other hand, 03, Cl show that any network 
coding problem can be reduced to an index coding problem. 

Security aspects of network coding has been studied in jTsll - llTsll . In particular, secure throughput of a network 
coding problem in the presence of an active adversary who can eavesdrop and corrupt some links are studied. A 
similar problem with active adversaries has been studied in ifTOll for the linear index coding problem. 

In this paper, we study secrecy in index coding from a different perspective. Our approach is similar to that 
of Shannon in his seminal paper ll20l . He analyzed the cipher system shown in Fig. [H comprising of a message 
M, a cipher text C, and a key K - a secret common randomness shared between the sender and the legitimate 
receiver. The sender wishes to transmit M to the legitimate receiver while keeping it secret from the eavesdropper. 
To this end, the sender transmits C (a function of M and K) on a public noiseless channel. By receiving C, the 
eavesdropper should not be able to attain any information about M. Shannon adopted the notion of perfect secrecy, 
of statistical independence between the message and the cipher text, i.e., I{M; C) = 0. Moreover, Shannon assumed 
zero-error recovery of the message; the legitimate receiver should be able to retrieve the message from C and K, 
imposing the constraint H{M\K,C) = 0. Shannon proved that the cipher system of Fig. [T]is perfectly secure, if 
the following inequality is satisfied: 

H{K)>H{M). (1) 

Roughly speaking, perfect secrecy is possible if and only if the key length is greater than or equal to the message 
length. Achievability follows from the one-time pad scheme. 

The goal of this paper is to derive a condition similar to inequality ([T]) for a general zero-error and perfectly 
secure index coding problem (observe that Shannon’s cipher system is a special index coding problem with one 
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Fig. 1. Shannon cipher system. 


receiver). Consider a scenario with t legitimate receivers, an eavesdropper, and a set of keys K shared between 
the sender and the legitimate receivers. The question is to find the minimum entropy of keys required for perfect 
secrecy. Moreover, the effect of perfect secrecy condition on the optimal index code length is studied. 

This paper deals with the three main theorems. The first one, proves a relation between secure and conventional 
(without secrecy) index coding problems. Eor a secure index coding problem, we propose a generalized one-time 
pad strategy which is shown to be optimal up to a multiplicative constant. The second theorem is a linear version 
of the first theorem, and finally, the last theorem discusses the equivalency of rate region in weakly and perfectly 
secure index coding problems (with zero or vanishing error probabilities). 

The rest of this paper is organized as follows. In Section HU the system model is defined. Section Hill lavs out the 
main results. We state the proofs in Section HV] Section FV] concludes this paper. 

Notation. Random variables are shown in capital letters, whereas their realizations are shown in lowercase letters. 
Bold letters are used to denote sets or vectors. Alphabet set of random variables are shown in calligraphic font. We 
use [f] to denote {1, 2, • • • , f} and Xs for some subset S of indices to denote the collection of (Xg : s S S). We 
use [a]+ to denote a if it is non-negative and zero otherwise. We use the term “conventional index code” to denote 
a classical index coding problem with no adversary and secret keys. 

II. System Model 

Conventional index coding is the problem of sending a set of t messages M = {Mi, M 2 , ■ ■ ■ , Mt} to t receivers. 
The i-th receiver wants the message Mi, having a subset of remaining messages M \ Mi = {Mi, M 2 , ■ ■ ■ , Mi-i, 
Mi+i,--- ,Mt} as side information. The side information set of i-th receiver is shown by Si. The goal is to 
minimize the amount of information that should be broadcast to the receivers for decoding their desired messages 
without any error. 

Now, assume that an eavesdropper coexists with the legitimate receivers. Just like legitimate receivers, the 
eavesdropper receives the index code C. However, we require that the eavesdropper should not be able to obtain any 
information about message set M from index code C (perfect secrecy). Erom an information theoretic perspective, 
the mutual information of M and C should be zero. To accomplish this, we assume that the transmitter and the 
legitimate receivers share common and private secret keys. The common key K is shared among the sender and 
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all of the legitimate receivers, and the private key Ki,i € [f] is shared between the sender and the i-th receiver. We 
are interested in the minimum entropy of the keys needed for perfect secrecy. 

Below, we formally define a secure index code. 

Definition 1 (Secure Index Code). Consider the scenario of Fig. \2\ consisting of a sender (who broadcasts 

data), t legitimate receivers, and an illegal receiver named as the eavesdropper. Also, assume a key set K = 

{K, Ki, K 2 , ■ ■ ■ ,Kt\ of common and private keys. A secure index coding scheme consists of an encoder and t 
decoders satisfying the perfect secrecy condition, defined as follows: 

1- Encoder: An encoder f maps the message set M and the key set K to a code symbol C G C, 

f : Ml X M 2 X • • • X Mt X /C X /Cl X ••• X /Ct X W ^ C. 

where Mi, 1C, ICi, and C are the alphabet sets of Mi, K, Ki, and C, respectively. Flere W is the alphabet set 

for W, which is the private source of randomness for the encoder, independent of all previously defined random 
variables, |W| = 1, the encoder will be deterministic. Random variable W is known only to the encoder. 

2- Decoder: A decoder gi,i = 1, ■ ■ ■ ,t recovers Mi from code symbol C, its side information Si, as well as the 
keys K and Ki, 

Pi : C X Si X 1C X ICi ^ Mi. (2) 

The recovery is exact: gi{c,Si, k, kf) = mi. Thus, for any i and arbitrary input distribution on the message set M, 
we should have: 

H{M,\C, S,,K,Ki)=Q. 

It means that each receiver should be able to retrieve its desired message from its side information, the code C, 
as well as the keys K and Ki with error probability zero. 

3- Perfect secrecy condition: assuming that K and Ki are mutually independent and uniform over their alphabet 


M = {Mi,M 2,--- ,Mt} 
K = {K,Ki,K 2,--- ,Kt} 



Fig. 2. The schematic of secure index coding scenario. 
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sets, the conditional pmf p{C = c\M = m) should not depend on the value of m, for any given c. Equivalently, 
for any distribution on input message M, we should have: 

/(M;C')=0, (3) 

as long as the message set M, the key set K and private randomness W are mutually independent. 

4- Rate vector: corresponding to a secure index code, a rate vector 

r = , r*, r^, , • • • ,rfcj (4) 


is defined, where 

log|A4i| log|/C| _ logj^ 

~ log|C| ’ " log|C| ’ " log|C| • 

Remark 1. Throughout, we reserve the notation “r^” for the rate of common key. It should not be confused with 
ri, r 2 , • • • , rt which are message rates. When we write for a variable i G [f], we mean one of ri, r 2 , • • • , r*, and 
not Tk- 

Remark 2. A secure index code is an extension of the conventional index code with no adversary. If we consider 
a zero-error index code that does not necessarily satisfy the perfect secrecy constraint, and has a rate vector of the 
following form. 


= (ri,r 2 ,--- ,rt,0,0, ••• ,0), (5) 

i.e., no secret keys exist = 0, then we get a conventional zero-error index code with rate vector 

(ri,r2, • • • ,rt). (6) 

Linear index codes form a subclass of the general problem, in which both encoder and decoders are linear 
functions. 

Definition 2 (Linear Index Code). A linear index code includes a linear encoder and t linear decoders so that: 

1- Encoder: A linear function f mapping the message set M and secret keys K to a code symbol C G F*, 

/ : F*^ X F^^ X • • • X F^‘ x F*'‘ x F*'‘i x F^*’^ x • • • x F^*’* x F*” —)• F*. 

where F is a finite field, li, Ik, Ik,, Iw ond I are respectively the length of message Mi, the length of the common 

key K, the length of private key Ki, the length of private randomness W, and the length of index code C. In other 
words. Mi, K, Ki, W and C are sequences of length li, Ik, Ik,, Iw ond I in the field F. 

2- Decoder: A linear function gi for i G [f] that acts on code symbol C, side information Si and secret keys 

K, Ki to recover the message Mi 


Pj : F' X X F'*’ X F''“i -)> F'* . 
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3- Rate vector: the rate vector of linear index coding is defined as follows: 

r = {ri,r2,--- , r*, rfe, , • • • ,rfcj 


where 


f ^ki 

n = y, r, = J, r,, = 


Each code symbol is a linear function of the components of Mi, K and Ki, i.e., 

Ik t t h Iw 

a = J2 +E E +E E -i)p^Ap )+E 

p=i j=i p=i j=i p=i p=i 

for some coefficients a^, /3®p, 7 *^ and in F. Here, 




K = {K{l),Ki2),--- ,K{lk)), 




and 


W={Wil),W{2),--- ,WiL)) 


are strings of symbols in F. Thus, the encoding scheme in linear index coding problem has the following matrix 
representation 


where 


lb 






■ 


7 } 

■ 7^ 

C 2 

= 


/3? 

■ /3t 


7? 

■ 7? 




/3i 

■ /3i 

■ 0 * 

7'i 

■ lij 


od 

= (al 

a\ ■ ■ 



= (Pm 

Pj2 • • 



= iih 


■ M 


= (^i 

^2 •• 

■ V'L; 


Kt 

W 

Ml 


\MtJ 


( 1 ) 


which construct the code generation matrix shown by H throughout this paper. 


Definition 3 (One-Shot and Asymptotic Index Coding). In the one-shot case, a single use of the index coding 
problem is considered. In other words, there are fixed message alphabet sets A4i, • • • , Xit, ond the goal is to 
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find an index code with minimum amount of keys and public communication that would ensure zero-error perfect 
secrecy. In other words, we are looking for the set of all possible minimal rate vectors 

r = (ri,r2,--' ,rt,rk,rk^, ■ ■ ■ ,rkt), 

as in ^ for fixed alphabet sets A4i,A42, • ■ • ,Mt- 

On the other hand, the asymptotic case asks for the set of all possible rate vectors r that are asymptotically 
achievable, i.e., there exists a sequence of zero-error and perfectly secure index codes whose rate vectors converge 
to r. 

Definition 4. The asymptotic secure index coding region, TZsecme, is defined to be the set of all asymptotically 
achievable tuples 

r = , r*, rfc, , • • • 

The conventional asymptotic index coding region is defined similarly using the achievable rate vectors as in equation 
©. We denote this regions by TZ. 

Remark 3. Observe that the region 7?.secure specifies TZ since 

r = {ri,r 2 ,-■■ ,rt, 00 , 00 ,-■■ ,oo), (8) 

is in the secure rate region if and only if (ri,r 2 , • • • ,rt) is in the conventional zero-error index code. Thus, finding 
the region 7?.secure is at least as difficult as finding TZ. We will show that finding the difficulty of finding T^secure 
when viewed from the origin is as difficult as finding TZ. 

Remark 4. In spite of the fact that the asymptotic case is commonly related to vanishing instead of zero probability 
of error, it has been shown in ED that in the conventional index coding (with no adversary or secret keys), zero 
and asymptotic error capacities are the same. 

Remark 5. Clearly, were a rate vector r one-shot achievable, it is also asymptotically achievable. Also, if 
(ri,r 2 , • • • ,rt,rk,rki, - ■ ■ is achievable, then so is (ri-ai,r 2 - 02 , • • • ,rt-at,rk-\-l3k,rkj +,8fei, • • • ,rkt + 
Pkt ) for any non-negative values of ai and /3fc and Pki ■ 

III. Main Results 

A. Generalized One-Time Pad Strategy 

Without loss of generality, let us assume a three-user case. As shown in Fig. [3 a possible strategy for the secure 
index coding problem is to use private key Ki and XOR it with part of the message Mi. This way, we can privately 
communicate parts of the messages. Then, for the remaining parts of the messages, we can find the optimal index 
code and XOR it with the common key K. This can be seen as a generalized version of one-time pad scheme 
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which is used in the Shannon’s cipher system. We will prove that this modified version of one-time pad strategy is 
optimal up to a multiplicative constant. 



Fig. 3. Generalized one-time pad strategy. Here message lengths, common key length, private key lengths and the index code length, are 
denoted by the li, 1^. and I, respectively. 


In Fig. [2 the remaining parts of the messages are secured by XORing them with symbols of K. Therefore, Ik 
should be greater than or equal to the length of optimal index code length needed for communicating the remaining 
parts of the messages, i.e., Ik > I- In order to be able to utilize the generalized one-time pad strategy, a further 
constraint needs to be met. In the index code for the remaining parts of the messages, we have compressed li — Ik^ 
symbols from user i into I index symbols, and therefore the rate of user i in this index code is equal to 


^ki ’^ki 

I ~ Tk 


i = 1,2,3. 


where (a) comes from perfect secrecy condition. Thus, the rate vector 


(9) 

V n rk rk ) 

must belong to the conventional index coding problem rate region (without secrecy constraints). The generalized 
one-time pad strategy works if the rate tuple given in equation (|9l), corresponding to the secure index coding rate 
tuple (ri,r 2 ,r 3 ,rfe,rfej,rfe 2 ,rfe 3 ), belongs to the conventional index coding region. The main theorem of this paper 
provides a converse to this result, up to a constant multiplicative factor. 


B. Optimality of generalized one-time pad up to a multiplicative constant 

Theorem 1. Given non-negative values for ri,r 2 ,--- , rt, rfc, , • • • ,rkt, the following three statements are 
equivalent: 


(a): Ba > 0 : a ■ (ri,r 2 , • • • ,rt,rfe,rfci, • • • ,rfcj £ T^secure, 
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(6) : 3a > 0 : a • ([ri - rfcj + , [r 2 - rfej + , • • • , [r* - rfej + ,rfc,0, • • • , 0) e 7^secLre, 


(c): ( 


[ri - rfcj+ [r2 - rfcj+ [r^ - rfej + 


rk 


rk 


Tk 


)en. 


Similarly, 


(a): 3a > 0 : a ■ (ri,r 2 , • • • ,'rt,'rfe,rfci, •'' G T^secure-Unear, 


(b) : 3a > 0 : a • ([ri - rfcj + , [ra - rfej + , • • • , [r* - rfcj + , rfc, 0, • • • , 0) G 7^s, 


ecure—Linear? 


h-rfcj+ 

(Cj . (-, -, • • • , - ) € /l-Linear- 

J'fe J'fe rk 

Here, to disambiguate the special case = 0 showing up in the denominator, we define c/0 to be zero if c = 0, 
and infinity otherwise. 


Corollary 1. In the case that only private keys Ki,i € [<:] are available, i.e., rk = 0, perfect secrecy is possible if 
and only if 

Tki >ri,ie [f]. 


This is because if Vk^ < Vi for some i, then [r^ — rkf\+/rk will be inhnity. This is a contradiction since the rates 
in index coding are at most one. 

Clearly, implies that we can do separate one-time pad on individual messages. With this strategy, the 

length of public communication I will be equal to X]i=i turns out that we cannot achieve zero-error perfect 

security with I < tti this case. 

Remark 6 . The Shannon cipher system is a special case of the secure index coding problem. In the Shannon 
cipher system, where we have one legitimate receiver, perfect secrecy condition necessitates r/rk < 1, where r 
is the message rate and rk is the key rate. Similarly, if we consider no private keys, the third statement of the 
above-mentioned theorem implies that ri/rk < 1,* G [f] which is an extension of the Shannon perfect secrecy 
condition to multiple receivers. 

Remark 7. Consider the first and third parts of the theorem. The factor a in the statement (a) specifies the cone 
of the secure rate region (if a multiplied by the rate vector is in the TZsecme, the rate vector itself belongs to the 
cone of this region when viewed from the origin). Hence, as shown in the Fig. @ the theorem intuitively states that 
the conventional index coding problem rate region determines the cone of the secure rate region. Moreover, the 
introduced generalized one-time pad strategy gives an achievable rate region which is a subset of T^secure and has 
a cone being the same as that of the secure rate region. 
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Cone of Secure Rate Region 


Conventional Rate Region 


Fig. 4. Conventional index coding region determines the cone of the secure rate region. The generalized one-time pad strategy obtains the 
entire boundary of the cone. 


Theorem 12] presents a similar statement to the Theorem [T] for the linear case. 

Theorem 2. Suppose we are given message alphabet sets Mi, M 2 , • ■ ■ , Mt where Mi = for some finite field 
F. Then, there exists a linear zero-error perfectly secure index code with key lengths {lk,lki,''' ,lkt) ond code 
length I, if and only if there exists a linear zero-error conventional index code (no secrecy) with code length Ik 
for message sets Mi, M 2 , ■ • • ,Mt where Mi = in which [a]-|_ is a if it is non-negative, and is zero 

otherwise. 

C. Variations on security and reliability constraints 

Our proof of Theorem [T] requires us to study the perfectly secure achievable rates under an asymptotically 
vanishing error criterion (rather than the exactly zero-error criterion). For this, we develop a result that can be 
understood as a perfectly secure version of the result of Ql on the equivalence of asymptotically zero and exactly 
zero network coding rates. Below, we provide a more general result than the one needed in the proof of Theorem 
[T] by comparing achievable rates of weakly secure codes with an asymptotically vanishing error, with those of 
perfectly secure zero-error codes. To proceed, let us define two other secrecy conditions, in addition to the perfect 
secrecy constraint mentioned in part 3 of Definition [T] 

Definition 5 (Strong Secrecy and Vanishing Error Probability). A rate vector 


r = {ri,r 2 , ■ ■ ■ ,rt,rk,rk^,- ■ ■ , rfcJ (10) 

is strongly secure achievable with a vanishing probability of error if for any e > 0, there is a code whose rate vectors 
is in the e distance of r, and furthermore, assuming a uniform and independent distribution over the messages in 
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M, the error probability of the code is less than or equal to e and 

\\pm,c -PMPcWi < e, 

where ||.||i is the total variation distance which is defined as the half of the (.i distance between two pmfs. 
Definition 6 (Weak Secrecy and Vanishing Error Probability). A rate vector 

r = (ri,r 2 ,--- , ?'t, ffc, , • • • ,rkj (11) 

is weakly secure achievable with a vanishing probability of error if for any e > 0, there is a code whose rate 
vectors is in the e distance of r. Furthermore, assuming a uniform and independent distribution over the messages 
in M, the error probability of the code is less than or equal to e and 

I{M-C) <e-H{M). 

It follows from the above definitions that perfect secrecy conditions is stronger than strong secrecy condition, 
which in turn is stronger than weak secrecy constraint. 

Theorem 3. Assume that (ri,r 2 , • • ■ ,rt,rk,rki,rk 2 -, • • ■ iffej is achievable by a sequence of weakly secure codes 
whose probabilities of error converge to zero asymptotically. We also allow the transmitter to use private random¬ 
ization in these codes. Then, 

(a) (ri, r 2 , • • • , rj, ^, • • • ,rkf) is achievable by a sequence of perfectly secure and e-error codes. 

(b) There is some a > 0 such that a - (ri, r 2 , • • • ,rt,rk, , rk ^, • • • itrkf} is achievable by a sequence of perfectly 
secure and zero-error codes, without using private randomization at the transmitter. 

To prove the Theorems [T] and [2 the following lemmas are needed. 

Lemma 1. If there exists an e-error perfectly secure code C with the rate vector 


then 

{[ri - + , [r 2 - rfej+,- - • , [r* - rfcj+, rfc, 0 , • • • , 0 ) 

is also e-error perfectly secure achievable. 

Lemma 2. Suppose that there is an e-error perfectly secure code C constructed from common key K and messages 
Mi for i S [f] where Mi and K are mutually independent uniformly distributed random variables. We assume that 
no private key Ki is used in the code. Then there is a sequence of conventional codes with zero-error probability 


whose rate vectors converge to 
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/ iJ(Mi) H{M2) H{Mt) \ 

C\K) ’ /(M; C\K) ’'' ’ ’ /(M; C\K)) ' 

IV. Proofs 

A. Proof of Theorem |7] 

Proof of (c)i-J’(b) for both linear and non-linear cases; Take a conventional index code C and messages Mi 
achieving rate tuple 

, [ri-rfcj+ ^ [r2 -rfcj+ ^ 

V C, t, , CJ. 

Tk Tk Tk 

We construct a new code on the same message sets, and a common keys K on the same alphabet set as C, i.e., 
\1C\ = \C\. We use one-time pad and add C with the common key K and broadcast it. The receivers can uncover 
the original C since they have access to K, but it remains hidden from the adversary. Observe that if the original 
index code is linear, the new index code is also linear. 

The rates of the new code is: 

,[ri-rfcj+ [r2-rfej+ _ 

\ ^5 ^5 ? 

Tk Tk 

, 0 ) 

Tk 

= a-{[ri - rfej+ - erfc, [ra - rkf\+ - er^, • • • , 

[n -rfcj+rfc - erfc,rfe,0,0, ••• ,0 ), 

where a = l/rk- Letting e converge to zero, we get the desired result. 

Proof of (b)i-^-(a) for both linear and non-linear cases: For the non-linear case, it suffices to show that if 

a ■ (ri,r2, • • • , r*, 0,0, • • • , 0) e 7^s ecure: 

then for any non-negative , • • • , one can find some a' > 0 such that 

a' ■ (n -I- rfej,r 2 -f rfe^, • • • , n -f rkt^rk.Tk^,- ■ ■ ,rkf) G TZsecme- 

A similar statement is sufficient for the proof of the linear case. Roughly speaking, the idea is to take a code 
with messages Mi and a common key K. Then we introduce private keys Ki and expand the size of the message 
Mi by the size of Ki. The new Ki bits of Mi are securely transmitted by taking their XOR with the symbols of 
the private key Ki. Again observe that if the original index code was linear, the new index code is also linear. 
For a rigorous argument, assume that we start with an index code with public communication C. We then have 
log I Adi I = ari logic I and log |A^| = arfclog|C| in the original code. For the new code, we set the size of the 
messages to be log |Adi| = a{ri -f Vkf) log |C|; the size of the common key to be log |A^| = ark log |C|, and the 
size of private keys to be log |/Ci| = avk^ log |C|. The size of the public communication in the new code that we 











13 


construct is log \C\ + J2l=i 1^*1’ we are sending |^i| additional XORs. Therefore, the rate tuple of 

the new code is 

a’ ■ (ri + r/ci, r2 + rfe2, • • • , r* + rfc^, r/c, , • • • , e 7^secure 


where 

, Q;log|C| a 

iog|ci+ x;Li log 1^*1 1 + ELi^fci 

Proof of (b)i— i"(c) for both linear and non-linear cases: The linear case is immediate from Theorem |2] For the 
non-linear case, we need to show that if 


3a > 0 : a - (ri,r2,-- - ,rt,rfc,0,--- ,0) e 7^secLre 


Then 


rk Tk Tk 


Take a secure index code with messages Mi for i G [f] and common key K whose rate vector is close to 
(ri,r 2 ,''- ,rt,rfe,0, ,0). Let C be the public communication of this code. Then log |/C|/log |C| is close to 
Tk and log I Alii/log |C| is close to ri. Hence, log |Ali|/log |/C| is close to ri/r^. 

Assuming that the messages Mi for i G [f] and common key K are uniform and mutually independent of each 
other, we have 


H{M) = H{M\C) + /(M; C) 

= H{M\C) (12) 

< H{M,K\C) 

= H{M\K, C) + H{K\C) 

< H{M\K, C) + H{K), 

where equality (fT^ comes from perfect secrecy condition. Hence, 

H{K) > I{M-K,C) 

= I{M-C\K) + I{M-K) 

= I{M-C\K). (13) 


where equality (fTsT l is due to independence of M and K. 

As our code is zero-error perfectly secure achievable, it is also e-error perfectly secure achievable. Then, by 
Lemma 121 the rate vector 


iL(Mi) H{M2) H{Mt) \ 

I{M; C\K) ’ /(M; C\K) ’ ’'' ’ /(M; C\K)) 


( 14 ) 
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belongs to the conventional index coding problem rate region. Therefore, by relation ( fOl l. if we replace I{M\ C\K) 
by H{K) in equation (fT4l i. we get that the rate vector 

/iT(Mi) H{M2) H{Mt)\ 

H{K) ’ H{K) ’ ■ ■ ■ ’ H{K) ) 

is in the zero-error conventional index coding region. Observe that log |A^i|/ log |/C| could be made as close as we 
desire to ri/r^. This completes the proof. 

We remark that one can have a simpler argument and avoid the use of Lemma|2]if the transmitter uses deterministic 
encoding, i.e., when there is no private randomness and C is a deterministic function of M and K. Observe that 

H(K) > I{M]C\K) 

= H{C\K) (15) 

> miniJ(C'|iT = k). 

k 

where inequality (fTsT i follows from the fact that C is a function of {M,K). 

If we fix a value of K = k, we get a zero-error index code. Therefore, there exists a zero-error index code 
whose public communication has length less than or equal to H{K) = log |/C|. The rate vector corresponding to 
this index code is coordinatewise greater than or equal to 

('Ll ll ll\ 

Tk Tk Tk 

Again as the previous, log |Adi|/ log |/C| could be made as close as we desire to r^/r^, and the proof is concluded. 
Proof of (a)i-^-(b): 

We begin with the linear case, i.e., 

3a > 0 : a • (ri,r2, - • • ,rt,rk,rk^,- ■ ■ ,rkt) € 7^Secure-Linear, 


implies that 


3a > 0 : a • ([ri - rfej+, [r 2 - rfc 2 ]+, • • • , [n - rfcj+,rfe, 0, • • • ,0) e 7?.secure-Linear- 
Take a sequence of linear secure zero-error index codes with rate vectors approaching 


a-(ri,r2,--- ,rt,rk,rk^, ■ ■ ■ , rfc J 

for some a > 0. Let {k, I, Ik, hi) for i G [f] be a code from this sequence. Then we can apply Theorem |2] to 
this code to construct a conventional zero-error linear index code with messages of size [k — lki]+ and h symbols 
of public communication. If we have a secret key of size h, we can use one-time pad and XOR it with the h 
symbols of public communication. This implies that we can find a secure zero-error index code with messages of 
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size \li — lki]+, public communication and common key of size Ik- This corresponds to the following rate vector 

5- • ([^1 - 4i] + , [^2 - lk2] + , • • • - lkt] + , 0, • • • , 0) = 

l-k 

I / [^1 ~ ^fci]+ [^2 ~ ^fc2]+ [h ~ ^kt]+ ^k „ „N 

Ik'^ I ’ I ’■■■ ’ I ’ ; 

which tends to 

— • ([ri - rfcj+, [r 2 - rfej+, ••• , [n - rfcj+,rfe,0, • • ■ ,0). 
rfc 

This completes the proof for the linear case. Next, we consider the general non-linear case. We need to show 
that 


3a > 0 : a • (ri,r 2 , • • • , rj, , • • • ,rfcj G T^secure, 


implies that 


3a > 0 : a • ([ri-rfcj + , [ra - rfej + , • ■ • , 

[k"t k'k^ ] +, k'k , 0, * • • ,0) G T^Secure ■ 

As the rate vector (ri,r 2 ,--' , rfc, , • • • ,rkt) is zero-error perfectly secure achievable, it is also e-error 
perfectly secure achievable. Then, using Lemma [T] by eliminating private keys, the rate vector ([ri — rfej+, [r 2 — 
rfcjJ + j • ■ • , [rt — rfej+, Tfe, 0, • • • ,0) is e-error perfectly secure achievable, too. We have constructed a code with 
asymptotically zero probability of error, not exactly zero probability of error as required in our model. To complete 
the proof, one is needed to prove that if (ri,r 2 ,--- ,rt,rk,0, ■ ■ ■ ,0) is e-error perfectly secure achievable, there 
exists a so that a • (ri, r 2 , • • • , rt, r^, 0, • • • ,0) is perfectly secure zero-error achievable. But this follows from part 
(b) of Theorem [3 

B. Proof of Theorem \2\ 

Assume that there exists a zero-error secure linear index code C with key lengths lk,lki{i G [t]) and private 
randomness of length l^. We assume that I equations are created by the transmitter from the message symbols and 
the private and public keys. Without loss of generality, we can assume that there is no zero-error secure index code 
C with 

{l[,--- = ,lt) 


but I' <l,l'k< Ik, I'ki < hi, C ^ and 

' hkt^h) ^ ’ jlkthw)- 

We refer to this as the minimality assumption. It implies that the code matrix 11 given in equation (|2l) has no all-zero 
column and the matrix 11 is full row rank. Otherwise, there exists a key bit or a message bit which has not been 
used in producing the index code, or the length of the index code could be reduced. 
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Our goal is to show that the minimality assumption implies that 1^ = 0 and furthermore one can use elementary 
row and other valid operations to convert the code matrix It to the following form, while preserving decodability 
and security of the code. 


^ 0 0 
0 0 

0 0 A(2) 


0 

0 

0 


\ 


r 


(16) 


\ 0 0 0 ... AW 




where A1°^ = Ii^.xik’ xik- ^re identity matrices, and F is a ^ x (X]i=i (») submatrix, which gets multiplied 

by the message vector. This statement implies, in particular, that the number of rows of matrix If should be equal 
to I = Ik + 

With elementary row operations, we bring the matrix If in its row echelon form, calling it If. Since the operations 
are invertible, the decodability and reliability constraints are preserved. Since If was full row rank. If does not have 
an all-zero row. By the minimality assumption, we also do not have an all-zero column in If. 

Each row of If has the form [0 0 • • • 0 1 * * • • • *]. The symbol 1 appearing in this row cannot correspond 
to a message symbol since the equation for this row will then correspond to a linear combination of only message 
symbols, which is a contradiction with the security assumption (observe that in equation (|7]i, message symbols 
come at the end of the vector). Therefore, the symbol 1 should correspond to either K{i) or Kjii) or W{i) for 
some i. We call a coordinate of K, Kj or W to be marked if it corresponds to a symbol 1 appearing as the hrst 
non-zero element of a row of If. Observe that each coordinate of K, Kj or W that is marked occurs only in one 
row of If because of its row echelon form. 

We claim that all coordinates of K and Kj and W are marked. Otherwise, if for instance K{i) is not marked for 
some i, we can hx it to be zero (effectively reducing the length of K by one). Decoding is still possible, since we 
had that given any arbitrary choice for K(i), decoding is possible; hence decoding is possible when K{i) is hxed 
to be zero for some i. The new code is also secure since every equation contains a marked element of one of the 
vectors K, Kj and W, and that element occurs in only and only that equation. Presence of these marked elements 
make the equations secure from the perspective of the adversary, as in one-time pad (mask the equations). Thus, 
the minimality assumption implies that all coordinates of K and Kj and W are marked, and Ft has the following 
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form 


/a(o) 

0 

0 

0 

0 

\ 

0 

Ad) 

0 

0 

0 


0 

0 

A(2) . 

0 

0 

r 

0 

0 

0 

. A(‘) 

0 


V 0 

0 

0 

0 


/ 


(17) 


where A(°) = = Ii^.xik- and = h^xi„ are identity matrices. Now, observe that the equations 

that are marked by coordinates of W are masked from all the receivers, as well as the adversary (each of these 
equations including the XOR with one and only one of the elements of W). Therefore, they are not useful in 
decoding of the messages by the receivers and can be removed. This implies that 1^^ = 0, and we get that If is in 
the desired form given in equation ( fThl l. 

We have shown that corresponding to any arbitrary linear zero-error perfectly secure code, there is another linear 
zero-error perfectly secure index code for the same message sets that uses secret keys of lengths - ■ ■ , ht) 

with the following property; each of the I symbols of the public message are of the form 


t ij 
i=i p=i 


(18) 


for some p £ [Z^], or 


t ij 

C,=K,{p) + Y,Y.^]j,M,{p) (19) 

7 = 1 P=1 

for some i S [f] and p G [Iki]- In other words, the expression of each of the code symbols Ci contains only one 
symbol from one of the secret keys. 

Consider the first receiver. It has access to I linear equations of the form given in (fTSl ) (as it has K), and li linear 
equations of the form given in ([19]) (as it has Ki). Therefore, we call the I equations as public to all receiver, and 
the li equations as private to the receiver one. We now use Lemma |3 with X = Mi and Y = (M 2 , M 3 , • • • , Mt), 
AX + BY being equations of the form given in (fTSl) . and CX + DY being the equations of the form given in ([T9j). 
This lemma then implies that there is a subset of the entries of Mi of size at most li such that from the values 
of these entries and the I public equations, receiver one can recover Mi. Let us fix Mi on these li locations and 
reveal its value to all the receivers. The number of free entries of Mi, i.e., the new length of the message of Mi, 
would then be greater than or equal to I — li. This message can be decoded by the first receiver using the I public 
linear equations of the form given in (IT^ . The fact that we have fixed some of entries of Mi and given it to other 
receivers can only help them recover their messages (because if they did not know Mi, we are giving them some 
partial information about Mi). A similar procedure can be done for other receivers. This would imply that with I 
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linear equations, it is possible for the receiver i to recover I — U symbols using I public symbols of message. This 
is the claim we wanted to prove. The proof is complete. 

Lemma 3. Let Xi^n ond Yixm be two arbitrary column vectors in a field F. Assume that matrices Aixn, Bixm, 
Ci-^xn o-nd Di-^xm o-re such that the vector X can be recovered from the values of AX + BY and CX + DY. 
Then, there is a subset of indices S C [n] with |iS| < h, such that it is possible to find X from AX + BY and 
X(i),i S S. Here X{i) is used to denote the i-th entry of vector X. 

Proof: Consider the first row of CX + DY, which is a linear equation in terms of the entries of X and 
Y, say 'Y^aiX{i) + ^ without having access to this row, we discard it and proceed 

to the second row. Otherwise, there is an entry of X, say ii that cannot be decoded without the linear equation 
o:iX{i) + other words, X{ii) is a linear combination of the linear equations that we have, with 

the equation ^ aiX{i) + X] (j) being given a non-zero weight. Then if we put ii in the set S of the entries 
that we know, we can conversely use it to recover the linear equation ^ aiX{i) + ^ PjY(j). Therefore, having 
X{ii) is equivalent to having ^ aiX{i) + ^ j3jY{j). Continuing with this procedure, we can construct the set S 
and its size will be less than or equal to the number of rows of CX + DY, which is ^i. ■ 

C. Proof of Theorem |5] 

1) Proof of part (a): The proof of part (a) consists of two steps. We first show the rate region equivalency of 
e-error strongly secure code to the e-error perfectly secure code. Then, we say that if a rate region is e-error weakly 
secure achievable, it is also e-etror strongly secure achievable. 

From Strong to Perfect Secrecy for Free: We are supposing a strong secrecy condition, i.e., the independence 
between M and C no longer exists, and instead, the following inequality holds; 

\\p{rn,c) - p(rn)p{c)\\i < e. 

We would like to make I{M-, C) = 0, without using additional key bits. Using the coupling method, one can find 
M', C having the marginal pmf p{m)p{c) and jointly distributed M, C with such that 

p{{M,C) ^ {M',C')) < ||p(m,c) -p(m)p(c)||i < e. 

Let Pm,c,m',C' denote the induced joint distribution by the coupling method. Observe that M' has the uniform 
marginal distribution p{m) and is independent of C'. The encoder proceeds as follows: the encoder assumes M' 
to be the intended messages to the receivers, produces M, C, C via the conditional distribution Pm,c,C'\m' 
broadcasts C. We have perfect secrecy as C is independent of M'. Since with probability 1 — e, random variables 
M' , C are equal to M, C, the total error probability will be increased by at most e that can be made arbitrarily 
small. This completes the proof. 

From Weak to Strong Secrecy for Free: Suppose we have a code C satisfying the weak secrecy condition, i.e., 
I{M-, C) < e ■ H{M), and error probability e. From Fano’s inequality, we have H{M\M) < 6, where M is the 
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vector of reconstructions by the decoders and S = h{e) + clog \M.\. 

Consider n i.i.d. repetitions of the code. Assuming that Ri = log \A4i\, we get |Ad"| = Let 

Ri=R,-2e- H{M) -25 -t, R, = 25 

where t is the number of nodes. We randomly and independently bin Ad” into 2”^* and 2”^* bins for i G [f], and 
denote the bin indices by Mi and Mi. Theorem 1 of ll22l provides sufficient condition for the following to hold: 


for any given 77 > 0 , there exists an integer n and such that 

~ Pm^mPC'^W ^ V (20) 

where the expected value is over all random binning indices and is the uniform distribution. The sufficient 
condition for the above to hold is that for each S C [f], the binning rate vector {Ri, Ri, R 2 , R 2 , ■ ■ ■ ,Rt,Rt) 
satishes the following inequality, 

Y,R^ + R^< HiMs\C) = H{Ms) - I{Ms; C) = ^ i?, - /(M 5 ; C). (21) 

i€S i£S 

Furthermore, by the Slepian-Wolf theorem, we can recover M” from (Ml^,Mi) with probability 1 — e (for n 
sufficiently large) for each i G [f] if 

i?, > iT(M,|M,), Vi e [t]. (22) 

If equations (1211 1 and (|22]) hold, one can hnd a deterministic binning such that 

\\pMmc« - PmPmPC- II ^ P (23) 

holds and furthermore, with probability 1 — e, M” can be recovered from 


We claim that equations (l2T]) and (l22ll hold for our choice of Ri = Ri — 2e ■ H{M) — 25 ■ t and Ri = 25. 
Observe that the right hand of the inequality (l22l l is less than or equal to h{e) + elog \Mi\ which is itself less than 
or equal to 5. To verify equation (|2TI) . we utilize the fact that the right hand of the inequality (|2TI) is greater than 
Sies Ri — e ■ H{M) by the assumption of weak secrecy. 

Equation (|2^ implies that we have strong security if we take as the public message for the new code 

and take Mi as the messages, we wish to transmit. The fact that M" can be recovered from (M”, Mi) implies that 
the i-th node is able to use C" to first find and then Mi to recover Ml^ with probability 1 — e. Then, from 
M", the node can recover its message Mi as its bin index. The overall error probability will be at most te by the 
union bound. 

We should only note that here the messages Mi are almost uniform and mutually independent, as from (|2^ . we 
have 

Wpm-pmW^p- 

But using the coupling method, as in the previous part, we can couple M with a mutually independent and uniform 
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messages M such that M = M with high probability. Therefore, we can impose the uniformity and independence 
constraint by slightly increasing the error probability of the code, and while preserving the strong security constraint. 
The rate of the original code was 

_ log|Ad,| _ R, 
log|C| “log|C|- 

Rate of the new code is 

- = ^ 

log|C|+i?* 

_R,-2e- H{M) -2S-t 
log \C\ + 25 

^ R^-2e■ ELi - 2(fe(e) + e ' t 

\og\C\ + 2ih{e) + ej:LiRi) 

^ ri-2e- n - 2(v + ^ 

l + 2(u + eX;!=i?'0 

where v = /i(e)/ log \C\ < h{e). Letting e converge to zero, we get that —>■ r^, i € [f]. 

2) Proof of part (b): We would like to show that if a rate vector (ri,r 2 , • • • ,rt,rk,rk^,rk^, • • • ,rkf) is e-error 
perfectly secure achievable, then there exist some positive multiplicative constant a so that 

a - (fi,r2,-- - ,rt,rfc,rfei,rfc2,-- - ,rfej 

could be achieved by zero-error perfectly secure codes. By Lemma [T] the e-error perfectly secure achievability 
of (ri,r 2 ,-'- ,rt,rfc,rfc^,rfc 2 , • • • ,rkt) leads to the e-error perfectly secure achievability of ([ri — rfcj + , [r 2 — 

+ j • • • ,[rt — rfej+, Tfe, 0, • • • ,0). In the following, we show that there exist some a > 0 so that a ■ {[ri — 

rfcj + , [r 2 —+ j • • • , [i"t — rkt] + , r’fe, 0, • • • , 0) is zero-error perfectly secure achievable. This claim would establish 
the desired result by using part (6) (a) of the Theorem [T] and adding back the private keys. 

Therefore, it remains to show that there exist some a > 0 so that a ■ ([ri — rfcj+, [r 2 — rkf\ + :- ■ ■ ,[rt — 

rfc, 0, • • • , 0) is zero-error perfectly secure achievable. To proceed, it suffices to show that if (ri, r 2 , • • • ,rt,rk, 
0, • • ■ ,0) is achievable by a sequence of codes with vanishing probability of error and perfect secrecy conditions, 
there exist some a > 0 so that a • (ri, r 2 , • • • , rt, 0, • • • ,0) is zero-error perfectly secure achievable. 

To do this, take an e-error code with corresponding variables K, C, and Mi for i G [f] where Mi and K are 
uniform and mutually independent random variables. Also let Mi to be the reconstruction by receiver i. Since 
private randomization at the transmitter is allowed, C is not necessarily a deterministic function of {K, M). 

As before, we have 


H{M) = H{M\C) + /(M; C) 
= H{M\C) 

< H{M,K\C) 


( 24 ) 
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= H{M\K, C)+H{K\C) 

<H{M\K,C)+H{K), (25) 


where equality (l24l i comes from perfect secrecy condition. Hence, 

H{K) > I{M-K,C) 

= I{M-C\K) + I{M;K) 

= I{M-,C\K) (26) 

where equality ( |26] ) is due to independence of M and K. Hence H{K) > I{M;C\K). Thus, the rate vector of 
the code is 


/iT(Mi) HiM^) H{Mt) H{K) 
'vlog|C| ’ log|C| ’■■■ ’ log|C| ’logICr ’ ’■ 
I{M]C\K) f H{Mi) H{M2) 


>0 = 


log|C| \l{M-,C\Ky I{M-C\Ky 
H{Mt) H{K) 


I{M-C\Ky I{M;C\K) 


,0,0, 


The term I{M; C|iT)/log \C\ is a multiplicative factor. Since H(K)/1(M; C\K) > 1 from equation (l26l l. to show 
that we can reach the rate vector 


iT(Mi) H{M2) 

H{Mt) H{K) 
I{M;C\K)’ I{M;C\K) 



with perfectly secure zero-error codes, it suffices to show that there is a sequence of perfectly secure zero-error 
codes whose rate vectors converge to 


H{My H{M2) H{Mt) 

I{M;C\K)’ I{M-,C\K)’ ’/(M; CliT) ’ ’ ’ ’ 


But the rate of r*, = 1 means that the size of common key and public communication are the same. Therefore 
one can always use one-time pad to ensure perfect security. It only remains to show that there is a sequence of 
conventional zero-error codes whose rate vectors converge to 

/ iJ(Mi) HiM2) H{Mt) \ 

\I{M;C\K)’ I{M-,C\K)’'" ’ I{M;C\K) J ' 


But this follows from Lemma |2] 


D. Proof of Lemma Q] 

We need to show that if (ri,r 2 ,--- ■ ,rfcj) is e-error perfectly secure achievable, by eliminating 

private keys, ([ri — rfej+, [r 2 — rk 2 \+, ■ ■ • — rkf\+, rfe, 0, • • • , 0) is e-eiTor perfectly secure achievable. 
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—^ 

f{M,K) 







^Si,K,K^,C = Yi 'r---^Si,K,C = Y^ 


^St,K,Kt,C = Yt ----^St,K,C = Yt 


Fig. 5. The schematic of secure index coding scenario in which the private keys Ki’s are not available at the receivers. 


Take an arbitrary index code C, K, Mi and Ki for i £ [f]. We create a new secure index code that does not have 
private keys and is able to securely and reliably achieve message rates (log \Aii\ — log |/Ci|)/ log \C\ for i £ [f] and 
the same common key rate log \K,\/ log \C\. This would conclude the proof. 

In the original code, we assume that Mi’s, K and Ki’s are mutually independent. Let us now consider a different 
scenario where the receivers do not have access to Ki’s. In other words, Ki for i £ [f] is simply treated as a private 
randomness of the transmitter. Thus, only the common key is shared with the legitimate receivers and the private 
keys, Ki, are not available at the receivers. Fig. |3 illustrates the secure index coding scheme by ignoring the private 
keys in the receivers. In the figure we use Y to denote the total information available at the receiver i when Ki’s 
are not available. Here, the adversary cannot learn anything about the messages. However, the problem is that the 
legitimate receivers cannot decode their intended messages. 

We construct a f-input, f-output interference channel as follows: the input of the Lth transmitter is Mi, and the 
output of the 2 -th receiver is Y. Using the result of ll23l p. 133] by treating interference as noise, rates (i?i, • • • , Rt) 
is asymptotically achievable with repeated use of this interference channel, if Ri < I{Mi,Y). Observe that 

/(M,; Y) = I{M£Y. K,) - I{M£ K,\Y) 

= I{M£Yi) - I{M£K,\Y) 

> H{M{) - h{e) - e • log |M1,| - /(M,; K,\Y) 

> H{Mi) - H{Ki) - h{e) - e ■ \og\Mi\, 

= log \Mi\ - log \lCi\ - h{e) - e ■ log \Mi\, 

where (a) follows from Fano’s inequality and the fact that Vi gives an e-error approximate of Mi. In other words, as 
the receiver i using Yi can recover Mi with the e probability of error, I{Mi;Yi) is approximately equal to H{Mi). 
Moreover, h{e) is the binary entropy. 

Therefore, messages of rates H{Mi) — H{Ki) can be sent with N uses of the original code. The input distribution 
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on will be uniform over the codewords, which is no longer uniform. However, the adversary would not learn 
anything about the messages since perfect security constraint holds as long as the common key is uniform and 
mutually independent of the messages; the marginal distribution of the messages is not important (see equation 
Q and the justihcation given for it). Hence, using the constructed code C, we could achieve the rate vector 
([j"! — ffej + i [i "2 — ’'fe 2 ]+i ■ • ■ j [ft — ffcj + , ffc, 0, • • • , 0) with asymptotically zero probability of error and perfect 
secrecy. 

E. Proof of Lemma |2] 

Consider a secure e-error code with corresponding variables C, and Mi for i G [f] where Mi and K are 
uniform and mutually independent random variables. It has been shown in ED that in the conventional index 
coding, zero and asymptotic error capacities are exactly the same. Therefore, we need to show that there is a 
sequence of conventional vanishing error codes whose rate vectors converge to 

/ iT(Mi) HiM^) H{Mt) \ 

\IiM- C\K) ’ /(M; C\K) ’' " ’ /(M; C\K)) ' 

From the perspective of the legitimate parties Ff is a common randomness, independent of the messages. We 
assume that the receiver i uses decoding function, as in equation (|2l). 


Pi : C X Si X 1C ^ A4i, 

to produce Mi. 

The above code induces a joint distribution p{M,C, K, M). Let us take n i.i.d. repetitions of {M,K). 
We would like to use the covering lemma ll23l Lemma 3.3]. If i? = I{M;C\K) -|- e', there is a codebook 
(1), (2), • ■ • , (2”^) of sequencos in C" for each fc", such that with high probability, given fc", m", one 

can hnd an index j where (j), k'^,mP) are jointly typical according to p{C, K, M). 

Now, let us construct a conventional index code (no secrecy) with messages Mf for i G [f] and a shared 
common randomness among all the parties. Having observed (k", m"), the transmitter hnds an index j where 
{Cfn{j),k",m^) are jointly typical. Index j is sent over the public channel. Sending this index requires only 
I{M-,C\K) + e' bits on average. Let us denote C^n.{j) by c". Now, receiver i gets a sequence c”, the common 
randomness iT" and its side information about other user’s messages. The decoder applies n copies of the same 
decoding function gk{-) to the sequences c", fc" and its side information about the messages (as if we were running 
n identical copies of the original code and c” was n copies of the message from the n instances of the code). 
This results in reconstructions fn^ that is jointly typical with {c^,k'^,m'^) with high probability according to 
p{M,C,K, M). This implies that in particular, (fn",m") will be jointly typical according to p{M,M) with 
high probability. But since in the pmf induced by the code, error probability P{M ^ M) < e, (jn^,rnP) are 
jointly typical only if fn{j) = m{j) for (1 — e)n values of j G [n]. 

Therefore, we have shown so far that with transmission of i? = n{I{M;C\K) + e') bits, we can ensure that 
with high probability, matches M on (1 — e) fraction of its entries. However, we need the whole 7W” to be 





24 


equal to M with high probability. We resolve this below, but observe that since the length of the messages are 
= nH{Mi), we have indeed reached the index code rate 

/ iJ(Mi) H{M2) H{Mt) \ 

\I{M-,C\K) + e'’ I{M-,C\K) + e'’"' ' I{M-,C\K) + e') ' 

Let us go back to the fact that with high probability 1 — (5, we have that Af" matches M on (1 — e) fraction of 
its entries, and not entirely. We show that this can be fixed with a negligible decrease in index coding rates. The 
idea is that by Fano’s inequality 

1 -- - 1 

-iT(M"|M ) < - + SH(M) + (1 - S)eH(M) 
n n 

can be made as close as we want to zero. Thus, using Slepian-Wolf theorem, conveying M with side information 
M at the decoder will require negligible amount of communication. To achieve this, one has to take N i.i.d. 

—-- n 

repetitions of AT" and M , and then use the Slepian-Wolf theorem to ensure that repetitions of AT" are recovered 
with high probability. 


V. Conclusion 

In this paper, we studied the index coding problem in the presence of an eavesdropper. Assuming that a common 
as well as a set of dedicated private keys are shared among the transmitter and legitimate receivers, we obtained 
a condition on keys’ entropies by which the index code could be transmitted securely. In Theorem [T] we made 
a relationship between the secure index coding problem to one without secrecy, and showed that the generalized 
one-time pad strategy is optimal up to a multiplicative constant for the secure index coding problem. In other words, 
we showed that the conventional index coding rate region determines the cone of the secure rate region, which is 
equal to the cone of the generalized one-time pad strategy. Theorem |2] presents a similar statement to the Theorem 
[T]for the linear case. Moreover, we showed in Theorem [3] that relaxing the secrecy condition from perfect to weak 
secrecy does not change the rate region when we have an e-error decoding condition. As a future work, one can 
study the effect of adversary’s side information and/or capability of corrupting the public communication. 

References 

[1] Y. Birk and T. Kol, “Informed-source coding-on-demand (iscod) over broadcast channels,” in INFOCOM’98. Seventeenth Annual Joint 
Conference of the IEEE Computer and Communications Societies. Proceedings. IEEE, vol. 3. IEEE, 1998, pp. 1257—1264. 

[2] M. J. Neely, A. S. Tehran!, and Z. Zhang, “Dynamic index coding for wireless broadcast networks,” in INEOCOM, 2012 Proceedings 
IEEE. IEEE, 2012, pp. 316-324. 

[3] N. Alon, E. Lubetzky, U. Stav, A. Weinstein, and A. Hassidim, “Broadcasting with side information,” in Foundations of Computer Science, 
2008. FOCS'08. IEEE 49th Annual IEEE Symposium on. IEEE, 2008, pp. 823-832. 

[4] E. Lubetzky and U. Stav, “Nonlinear index coding outperforming the linear optimum,” Information Theory, IEEE Transactions on, vol. 55, 
no. 8, pp. 3544-3551, 2009. 

[5] Z. Bar-Yossef, Y Birk, T. Jayram, and T. Kol, “Index coding with side information,” Information Theory, IEEE Transactions on, vol. 57, 
no. 3, pp. 1479-1494, 2011. 

[6] A. S. Tehran!, A. G. Dimakis, and M. J. Neely, “Bipartite index coding,” in Information Theory Proceedings (ISIT), 2012 IEEE International 
Symposium on. IEEE, 2012, pp. 2246-2250. 





25 


[7] A. Blasiak, R. Kleinberg, and E. Lubetzky, “Broadcasting with side information: Bounding and approximating the broadcast rate,” 
Information Theory, IEEE Transactions on, vol. 59, no. 9, pp. 5811-5823, 2013. 

[8] -, “Index coding via linear programming,” arXiv preprint arXiv:1004.}379 2010. 

[9] F. Arbabjolfaei, B. Bandemer, Y.-H. Kim, E. Sasoglu, and L. Wang, “On the capacity region for index coding,” in Information Theory 
Proceedings (ISIT), 2013 IEEE International Symposium on. IEEE, 2013, pp. 962-966. 

[10] K. Shanmugam, A. G. Dimakis, and M. Langberg, “Graph theory versus minimum rank for index coding,” arXiv preprint arXiv:1402.3898 
2014. 

[11] Z. Bar-Yossef, Y Birk, T. S. Jayram, and T. Kol, “Index coding with side information,” in Foundations of Computer Science, 2006. EOCS 
'06. 47th Annual IEEE Symposium on, Oct 2006, pp. 197-206. 

[12] R. Peeters, “Orthogonal representations over finite fields and the chromatic number of graphs,” Combinatorica, vol. 16, no. 3, pp. 417-431, 
1996. 

[13] S. El Rouayheb, A. Sprintson, and C. Georghiades, “On the index coding problem and its relation to network coding and matroid theory,” 
Information Theory, IEEE Transactions on, vol. 56, no. 7, pp. 3187-3195, 2010. 

[14] M. Effros, S. E. Rouayheb, and M. Langberg, “An equivalence between network coding and index coding,” arXiv preprint arXiv:1211.6660 
2012 . 

[15] K. Bhattad and K. R. Narayanan, “Weakly secure network coding,” NetCod, Apr, vol. 104, 2005. 

[16] M. Bloch and J. Barros, Physical-layer security. Cambridge University Press, 2011. 

[17] S. Jaggi, M. Langberg, S. Katti, T. Ho, D. Katabi, and M. Medard, “Resilient network coding in the presence of byzantine adversaries,” 
in INFOCOM 2007. 26th IEEE International Conference on Computer Communications. IEEE. IEEE, 2007, pp. 616-624. 

[18] R. W. Yeung, Information theory and network coding. Springer, 2008. 

[19] S. H. Dau, V. Skachek, and Y M. Chee, “On secure index coding with side information,” in Information Theory Proceedings (ISIT), 2011 
IEEE International Symposium on. IEEE, 2011, pp. 983-987. 

[20] C. E. Shannon, “Communication theoiy of secrecy systems,” Bell system technical journal, vol. 28, no. 4, pp. 656-715, 1949. 

[21] M. Langberg and M. Effros, “Network coding: Is zero en'or always possible?” in Communication, Control, and Computing (Allerton), 
2011 49th Annual Allerton Conference on. IEEE, 2011, pp. 1478-1485. 

[22] M. H. Yassaee, M. R. Aref, and A. Gohari, “Achievability proof via output statistics of random binning,” Information Theory, IEEE 
Transactions on, vol. 60, no. 11, pp. 6760-6786, 2014. 

[23] A. El Gamal and Y.-H. Kim, Network information theory. Cambridge University Press, 2011. 


